I'm in the camp where I don't want systems to do fancy validations on passwords but I do think expiring passwords is not a bad idea. The thing is that many times your password can get stolen and you might not even know it. I've seen people writing down their passwords on sticky notes, saving in Chrome, get stolen by fake apps etc. At least for Windows, expiring passwords wasn't huge pain because of integrated authentication everywhere.
Password expiration is dead, long live passwords
141–150 of 316 posts
Re: Password expiration is dead, long live passwords
#142Another worst offender are security questions to unlock accounts. Answers to these questions are usually visible to customer service reps and similar set of questions are asked among different services. This is scary. It's dangerous as having password stored in plain text as answers to the security questions can potentially unlock many other accounts. I highly suggest everyone answers each of them with a unique answe…
I've long since started just putting in random password strings for these.
Currently locked out of my bank for the weekend because of this :)
Re: Password expiration is dead, long live passwords
#143The other part of this story I did not see mentioned is that I suspect that password expiration also makes organizations more vulnerable to social engineering hacks because legitimate users (I have done this) become locked out due to poorly managed password expiration, then have to call in to restore access. The use of insecure identity and authentication mechanisms like student IDs and security questions is a recipe…
Unfortunately we still have to have similar authentication methods for other password resets. Users have an alarming tendency to forget their passwords after a week or two of holiday.
Also not helped by the fact that passwords have to include every symbol and their mother, cannot include sequential digits, cannot include sequential letters, cannot include any letter of your name, and a bunch of other inane rules that could be changed to simply having a minimum length of 12 instead of 8...
Re: Password expiration is dead, long live passwords
#144This has known for years now, but unfortunately, takes a long time to change. The other thing what I just read recently and mentioned in this article is about storing secrets in environment variables. That's not good either because every running code and subprocess can read it...
As an ignorant person who doesn't do multiuser anything, how is this a problem if you are sure you're the only user of a physical system? The moment my computer is compromised by anyone else I'd think all bets are off then.
I think the recent compromise at matrix.org [1] is a good example of how better defence in depth could have mitigated the damage done by an attacker who compromised a trusted machine. Specifically, access to a developer's SSH agent was the critical privilege escalation vector in this attack.
Re: Password expiration is dead, long live passwords
#145Earlier quoted context omitted.
What I do: 1. Check the password against the haveibeenpwned.com database. 2. Check the password with the zxcvbn password strength library. If it passes both they can use it. It's not perfect, but it's a lot better than nothing.
I don't think checking against haveibeenpwned is a good idea. They recommend against checking your current password, and you're automatically checking every users current password?
From memory their system works by a using a partial-hash, minimising the leak of the password.
So for: * Password: trustno1 * Hash: 1234567890abcdefghij
You send to the api:
* Hash: 12345
And it returns all hashes it knows of that start with 12345 along with a count of how many times each hashed password has been breached.
You then compare that list to see if your full hash exists in there.
If it exists - it's been breached. If not - you're clear.
Re: Password expiration is dead, long live passwords
#146Recent, frustrating example: My (business) bank uses FISERV software, and their software expires passwords every 90 days. Their software can notify you about a million combinations of account activities and statuses, except this one. It takes 3 values to login to the account (company ID, username, password). When logging in via mobile app, it never tells you that your password has expired, so I end up trying a few ti…
The problem with having a short expiration is that it forces people to simply use their password with a count:
password1, password2, ... password23, password24.
This means that if you discover someone's current password, you also have their future 10+ passwords as well.
Re: Password expiration is dead, long live passwords
#147I've always wondered how many engineer hours have been lost on the phone with helpdesks sorting out expired passwords.
I did some lunch table math a few weeks ago. Assuming it takes on average 30 min for an employee to rotate a password (reboots, re-logins, etc.), assuming an average $50/hr across all employees, ~600k employees @ 4 changes per year (my current company policy is ever 80-ish days) = $60MM of human time spent per year making the company less secure .
It doesn’t take 30 minutes to change my password from ‘password5’ to ‘password6’ though.
Re: Password expiration is dead, long live passwords
#148Earlier quoted context omitted.
Unfortunately we still have to have similar authentication methods for other password resets. Users have an alarming tendency to forget their passwords after a week or two of holiday.
Also not helped by the fact that passwords have to include every symbol and their mother, cannot include sequential digits, cannot include sequential letters, cannot include any letter of your name, and a bunch of other inane rules that could be changed to simply having a minimum length of 12 instead of 8...
A couple of years ago one of my banks "upgraded" its web site, forcing me to change my password to comply with its revised password guidelines since my old password was no longer permitted.
The result was a password that was shorter, less varied, and less secure than the previous one.
Good job, Chase.
Re: Password expiration is dead, long live passwords
#149Earlier quoted context omitted.
Some never memorize their passwords at all. Instead relying on 'forgot' emails and "Remember Me" features entirely.
I have wondered if some web pages effectively have this as the main log in method. If you have a hurricane tracking page, everyone is going to forget their passwords in between hurricane seasons.
I've seen Blendle and a couple of other web sites do this.
You go to the login page, and your choices are federated login, standard login, or a one-time login e-mail.
Re: Password expiration is dead, long live passwords
#150Earlier quoted context omitted.
Some never memorize their passwords at all. Instead relying on 'forgot' emails and "Remember Me" features entirely.
I have wondered if some web pages effectively have this as the main log in method. If you have a hurricane tracking page, everyone is going to forget their passwords in between hurricane seasons.
Yahoo Japan (not really related to the defunct original Yahoo and still very successful in Japan) recently abolished passwords for new accounts.
You can only login with reset emails or SMS codes, which is pretty annoying.